OpenCATS 0.9.4 Remote Code Execution via Resume Upload

Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function

OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality

OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution

OpenCATS: Authenticated RCE in the Import module

OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel

OpenCATS - SQL Injection in DataGrid sortDirection Parameter

OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column

OpenCATS PHP Code Injection via installer AJAX endpoint

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system

OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function

OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable

OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function

OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function

Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be…

Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues

OpenCATS before 0.10.0 Missing Authorization via Import Revert Action

A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state…

A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city…

Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests

Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description…

An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters

Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar

OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports

OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints

OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php

OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints

A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors

OpenCATS Career Portal CareersUI.php processLogin excessive authentication